Leaked NSA Hacking Tool On Global Ransomware Rampage

from the who-trusts-the-nsa? dept

Welp. What was that we were saying about the problems of the NSA creating hacking tools that leak, rather than helping patch security flaws? Oh, right. That it would make everyone less safe.

And here we are. With a global ransomware rampage, referred to as "WannaCry" putting tons of people at risk, thanks to leaked NSA malware:

Leaked alleged NSA hacking tools appear to be behind a massive cyberattack disrupting hospitals and companies across Europe, Asia and the U.S., with Russia among the hardest-hit countries.

The unique malware causing the attacks — which been spotted in tens of thousands of incidents in 99 countries, according to the cyber firm Avast — have forced some hospitals to stop admitting new patients with serious medical conditions and driven other companies to shut down their networks, leaving valuable files unavailable.

Specifically, it appears that the ransomware is using an NSA tool called ETERNALBLUE, which was leaked in April by Shadow Brokers. This was among those that were quietly patched by Microsoft back in March, but not everyone installs security patches in a timely manner. Indeed, as some are reporting, some of the victims -- including the National Health Service Hospitals in the UK -- are running ancient Windows XP, an operating system that is not even remotely secure, and is no longer supported.

Thus, there's some debate online about whether the "problem" here is organizations who don't upgrade/patch or the NSA. Of course, these things are not mutually exclusive: you can reasonably blame both. Failing to update and patch your computers is a bad idea these days -- especially for large organizations with IT staff who should know better.

At the same time, the fact that this hack is built off of a leaked NSA hacking tool highlights a couple of key points:

1. The NSA's dual-hatted offensive & defensive structure is damaging: The NSA plays both offense and defense on computer security. That is, it is supposed to hack into other systems, but also help protect our systems. But it's quite clear that the offensive capabilities are valued much more than the defensive ones -- and that's a problem. Once again, it appears that people in the intelligence community are not doing a clear cost-benefit analysis of the tools that they use. They like their toys, but they rarely seem to take into consideration what happens should those toys get out.
2. Once again, this reinforces why we should not allow backdoors to encryption or any other such vulnerability. Over and over again, the proponents of backdooring encryption have insisted that it can be built in a "safe" way, where only government will get the backdoor access to encryption. The fact that some of the NSA's most powerful hacking tools have not only been leaked but are now wreaking havoc around the world, should put a complete end to the "going dark" debate. But it won't. It's not safe, but many in the law enforcement community, in particular, are in denial about this.

These problems are not new. Hell, we've been talking about both of them for the better part of a decade already. But this rapid spread of WannaCry is putting an exclamation point on those arguments. Unfortunately, the cynical side of my brain says this warning will still be ignored.

Filed Under: hacking tools, malware, nhs, nsa, ransomware, shadow brokers, wannacry

Ransomware Attack Left DC Police Surveillance Blind Shortly Before The Innauguration

from the feeling-safer-yet? dept

Once exclusively the domain of hospitals with comically-bad IT support, crippling ransomware attacks are increasingly beginning to impact essential infrastructure. Just ask the San Francisco MTA, whose systems were shut down entirely for a spell last fall after a hacker (with a long history of similar attacks) managed to infiltrate their network, forcing the MTA to dole out free rides until the threat was resolved. Or you could ask the St. Louis public library network, which saw 16 city branches crippled last month by a bitcoin-demanding intruder.

We've also seen a spike in ransomware attacks on our ever-expanding surveillance and security apparatus, DC Police acknowledging this week that 70% of the city's surveillance camera DVRs were infected with malware. The infection was so thorough, DC Police were forced to acknowledge that city police cameras were unable to record much of anything during a three day stretch last month:

"Hackers infected 70 percent of storage devices that record data from D.C. police surveillance cameras eight days before President Trump’s inauguration, forcing major citywide reinstallation efforts, according to the police and the city’s technology office. City officials said ransomware left police cameras unable to record between Jan. 12 and Jan. 15. The cyberattack affected 123 of 187 network video recorders in a closed-circuit TV system for public spaces across the city, the officials said late Friday.

Brian Ebert, a Secret Service official, said the safety of the public or protectees was never jeopardized.

Right. An intruder managed to effectively blind law enforcement in the nation's capital for three straight days -- eight days before the inauguration of a new President, but hey -- no big deal. Fortunately the city was able to purge the malware and reboot the system without paying a ransom, though they still don't appear to have actually tracked down the intruder or his or her point of origin:

"Archana Vemulapalli, the city’s Chief Technology Officer, said the city paid no ransom and resolved the problem by taking the devices offline, removing all software and restarting the system at each site. An investigation into the source of the hack continues, said Vemulapalli, who said the intrusion was confined to the police CCTV cameras that monitor public areas and did not extend deeper into D.C. computer networks."

These intrusions are usually courtesy of an employee downloading something stupid, but the paper-mache grade security and default administrative credentials common on DVRs and other network-connected hardware also plays a starring role. The end result is an absolute laundry list of similar stories popping up all around the globe, from the Austrian hotel whose customers were locked inside their rooms thanks to a ransomware intruder, to the Texas police station that lost years of video evidence courtesy of poor security standards and a lack of redundancy.

And it's worth remembering that these are only the intrusions in which the intruder actually wants to make their presence known.

Overall, poorly secured internet-connected devices have not only contributed to a spike in ransomware attacks, but poorly-secured hardware is increasingly being infected and used as part of DDoS botnets, resulting in some of the largest and most devastating attacks we've seen to date. The IT security 2017 prediction du jour is a crippling attack that brings the internet to its knees sometime this year, with a loss of human life on some scale also seen as an inevitability. As several security analysts like Bruce Schneier have noted, our casual treatment of device security has created a security and privacy dumpster fire, and the spike in these DDoS and ransomware attacks is simply the check coming due.

Filed Under: cameras, cctv, dc, inauguration, malware, ransomware, surveillance, surveillance cameras

Police Say No Evidence Of Value Was Lost In Ransomware Attack, Except Maybe Some Stuff Defense Lawyers Might Find Useful

from the all-good-on-THIS-side,-assume-same-for-others,-etc. dept

Ransomware is everywhere. And it's affecting everything, including critical systems. Sure, it's kind of humiliating to be locked out of your smart TV, but hospitals are being locked out of patient records and --in a new twist -- hotel guests are being locked out of their rooms.

Then there's something like this, where the chain of evidence is disrupted by ransomware purveyors.

The Cockrell Hill Police Department lost video evidence and a cache of digital documents after hackers invaded the department’s computer system last month.

Stephen Barlag, Cockrell Hill's police chief, said the incident was not the work of hackers, but acknowledged that the incident included a computer-generated ransom demand.

"This was not a hacking incident," Barlag said in a news release Wednesday evening. "No files or confidential information was breached or obtained by any outside parties."

[Rather entertaining to note WFAA's opening sentence is immediately contradicted by the Police Chief's statements. #journalism]

While it's reassuring no evidence was obtained by outside parties, it's not that much more reassuring to hear the owner of the data couldn't access it either. The PD consulted with the FBI before coming to conclusion that the files might still be inaccessible even if it did pay the $4,000 ransom.

The department, however, is not being all that upfront about the possible negative effect this might have on criminal defendants, who might want to challenge the evidence against them or look through it for anything exculpatory. The department -- despite admitting its backup was similarly infected -- claims this is no big deal.

Barlag said of the lost files, “none of this was critical information.”

Define "critical."

"Well, that depends on what side of the jail cell you're sitting," said J. Collin Beggs, a Dallas criminal defense lawyer who has a client charged in a Cockrell Hill felony evading case involving some of the lost video evidence.

This would be video evidence Beggs has been asking for since last summer -- well before the PD's files were wiped out by ransomware. It could be very critical information, despite Police Chief Barlag's assertion to the contrary. What's useful to a defendant is seldom viewed as useful by law enforcement. Hence the difference of opinion.

But even while stating nothing of (subjective) value was lost, Chief Barlag did admit there was a possibility that defense lawyers might be interested in finding out what evidence might no longer be available. And the department may not have made this loss public if it hadn't needed to speak to defendants about its inability to secure relevant evidence.

Barlag said he didn’t know how much of of the digital material lost was evidence in pending criminal cases, but acknowledged that some of it was. He said no cases have been dismissed that he knows of because of the losses.

Well… yet. The infection wasn't discovered until December 12th and the department didn't go public until more than a month after that. So, news that evidence needed in prosecutions may not be available has spread very slowly. And the details of what's recoverable makes it clear that the department values narrative over less-biased documentation. The police reports are retained in hard copy. Any recordings of incidents detailed in these reports are apparently backed up in a more haphazard fashion.

Some of the videos were backed up on CDs, but those that were not are lost.

No police reports, nor any criminal history information, was lost, Barlag said.

Comforting… for the police department. Not so much for criminal defendants, who are going to have an even harder time arguing against "our word vs. yours" assertions -- which cops can back up with police reports while giving defendants nothing at all to push back with.

Filed Under: cockrell hill police department, evidence, hack, police, ransomware, stephen barlag

Man Has To Beg LG To Uncripple His 'Smart' TV After Ransomware Attack

from the dumb-is-the-new-smart dept

We've noted repeatedly how "smart" television sets have the same security issues plaguing the rest of the internet of broken things: namely there often isn't any security to speak of. The net result has been TVs that spy on you by recording in-home audio, and in some cases transmitting that data unencrypted around the internet. But we've also noted how these TVs -- like the rest of the Internet of Things -- can be compromised in a matter of moments by some rather rudimentary hacking, then incorporated into the historically unprecedented DDoS attacks we're now seeing around the world.

As an added bonus, your smart TV can now be infected by ransomware, too. Software engineer Darren Cauthon found this out the hard way when he awoke on Christmas Day to find that his family's LG 50GA6400 had been infected with a version of the Cyber.Police ransomware -- aka FLocker, Dogspectus, or Frantic Locker. That particular ransomware posts an image to the screen of the television pretending to originate with the FBI, and claiming that users must pay a $500 penalty to return full functionality to the television.

Cauthon quickly headed to Twitter to not only complain that his television was now demanding a payment just to function -- but that LG's online factory reset instructions for the TV in question didn't work:Worse, perhaps, Cauthon stated that when he contacted LG, he was shuffled around several support departments before being told that he might have to bring the TV in to be serviced by a technician (for a $340 surcharge):

"Cauthon says he tried to reset the TV to factory settings, but the reset procedure available online didn't work. When the software engineer contacted LG, the company told him to visit one of their service centers, where one of its employees could reset his TV.

This angered Cauthon because factory reset procedures shouldn't be secret, but also because the service center visit implied a $340 bill. The ransomware asked Cauthon to pay $500 to unlock his TV.

As one commenter on Twitter pointed out, it would be cheaper to buy a new TV. "Avoid these 'smart tvs' like the plague," Cauthon added following his discussion with LG."

Ultimately LG reached out to Cauthon to help by providing the correct factory reset sequence, though the infection should have never been possible to begin with. While it's possible that the infection could have come via a dubious download from the Google app store, the design of the television should never allow an application to take complete control of the device in the first place. While these infections are rare, other LG users have complained about similar attacks, and found removal of the offending malware to be difficult -- especially given the lack of control users often have over devices they purportedly "own."

Of course, security firms like Symantec have been warning about the rise of TV infections since 2015, noting that while in some instances a factory reset will solve the issue, in many instances removing the malware can be borderline impossible for a less technical user. And like so many internet of broken things devices, these TVs often fail to include basic functionality allowing users to determine what traffic the television is sending over the network, or settings allowing users to protect their security. It's just one more example of how "smart" devices are frequently dumber than the technology they're replacing.

Filed Under: factory reset, ransomware, smart tv
Companies: lg

Malware Purveyor Serving Up Ransomware Via Bogus ICANN Blacklist Removal Emails

from the for-best-results,-enable-macros dept

Fun stuff ahead for some website owners, thanks to a breakdown in the registration process. A Swiss security researcher has spotted bogus ICANN blacklist removal emails being sent to site owners containing a Word document that acts as a trigger for ransomware.

Fake @ICANN Domain Abuse Notices being spammend out to domain owners, distributing malware (Dridex?) - icann-monitor[dot]org

These fake @ICANN abuse notices distribute Cerber Ransomware (hXXp://csenet.org/view/file5.exe) calling out to ffoqr3ug7m726zou.1nuljt\.top

The email appears to orginate from somewhere legitimate, as seen in this screenshot:

But the quasi-legit URL (icann-monitor.org) was only very recently registered through eNom, which apparently had no problem with some internet rando snagging a URL closely associated with the international group that governs domain names.

Domain Name: ICANN-MONITOR.ORG
Domain ID: D402200000001096932-LROR
WHOIS Server:
Referral URL: http://www.enom.com
Updated Date: 2016-12-29T15:25:14Z
Creation Date: 2016-12-28T20:19:57Z
Registry Expiry Date: 2017-12-28T20:19:57Z
Sponsoring Registrar: eNom, Inc.
Sponsoring Registrar IANA ID: 48
[...]
Tech Email: legal@whoisguard.com
Name Server: DNS1.REGISTRAR-SERVERS.COM
Name Server: DNS2.REGISTRAR-SERVERS.COM

Ironically, the emails containing this malware inform recipients that their domain is "being used for spamming and spreading malware." The spam email invites site owners to download a malware-laced "report" for further instructions on how to remove their site from the blacklist, warning them they only have 24 hours to fall victim to ransomware respond.

The researcher is now "counting the hours (days?)" until either eNom or ICANN act in response to this spoofing/ransomware attack. Don't hold your breath. ICANN has yet to say anything publicly about this and, as of this point, eNom has yet to deactivate the account. For now, the fake ICANN still lives and breathes and poses a threat to recipients of this official-looking email.

Filed Under: blacklist, malware, ransomware
Companies: icann

A Nasty New Twist In Ransomware: To Decrypt Your Files Without Paying, Spread The Infection To Others

from the putting-the-mal-in-malware dept

Techdirt first wrote about ransomware back in 2010. Even then, we noted it was nothing new, but that a further twist on the idea had appeared. Well, here we are, nearly in 2017, and ransomware is still with us -- so much for tech progress -- and new twists are still appearing, as the Guardian reported recently:

Any user who finds themselves infected with the Popcorn Time malware (named after, but unrelated to, the bittorrent client) is offered the ability to unlock their files for a cash payment, usually one bitcoin ($772.67/£613.20).

But they also have a second option, described by the developers as "the nasty way": passing on a link to the malware. "If two or more people install this file and pay, we will decrypt your files for free".

This really puts the "mal" in "malware," since it makes a naked appeal to a victim's worst nature. A post on the site BleepingComputer.com offers more details of what seems to be a "work" in progress, including a screenshot of the ransom note, which contains the following information about those who claim to be behind this:

We are a group of computer science students from Syria, as you probably know Syria is having bad time for the last 5 years. Since 2011 we have more than half million people died and over 5 million refugees. Each part of our team has lost a dear member from his family. I personally have lost both my parents and my little sister in 2015. The sad part of this war is that all the parts keep fighting but eventually we the poor and simple people suffer and watching our family and friends die each day. The world remained silent and no one helping us so we decided to take an action.

Be perfectly sure that all the money that we get goes to food, medicine, shelter to our people. We are extremely sorry that we are forcing you to pay but that's the only way that we can keep living.

Well, maybe. But given the ruthlessness of the coders in offering a "nasty way" out of their threats, perhaps this is just another shrewd attempt to manipulate the ransomware victims -- one that is cynically exploiting the very real Syrian tragedy that is unfolding before our eyes.

Until now, malware has been a simple arms race between the authors of harmful code, and the companies making anti-virus products that try to spot the code before it can infect a user's system. The new Popcorn Time ransomware adds a new dimension, and seeks to make the victim an active and complicit vector of infection.

This opens up all kinds of possibilities. For example, we might see ransomware that starts to offer bonuses according to the number of people you infect. You can always claim it was the malware, not you, that sent the program, and nobody will know about your Bitcoin payments. Maybe inventive Techdirt readers can come up with a few more "nasty" ideas that build on this latest twist in ransomware coding.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: infection, popcorn time, ransomware

San Francisco MTA Forced To Give Free Rides After Network Infected With Ransomware

from the pwned dept

We've noted consistently how the medical industry has become a hotbed of ransomware attacks thanks to too many incompetent IT administrators, and too many hardware vendors for which security is a fleeting afterthought. In fact, hospitals are now seeing more than 20 ransomware attacks a day; attacks that in many instances have forced the cancellation of scheduled surgeries and wreaked havoc on the day-to-day operations of many in the healthcare sector.

But security incompetence isn't restricted just to the healthcare industry. Last week, the San Francisco mass transit system learned this the hard way when hackers effectively took over transit systems used by the San Francisco Municipal Transit Agency, infecting them with ransomware and refusing to return control unless the city was willing to pay $73,000 in bitcoin. The hack hasn't just disabled the city's transit systems, but apparently has crippled the SF MTA's payroll systems, email servers, Quickbooks, NextBus operations, various MySQL database servers, and staff training and personal computers for hundreds of employees.

All told, it's believed that hackers compromised about 2,112 of the 8,656 computers attached to the SF MTA's network. As a result, the city had to simply unlock all turnstiles and let riders ride the system for free as it tried to climb out from underneath the mess:Like most ransomware attacks, the SF MTA is being told to make a payment to an anonymous bitcoin wallet if they want the key to decrypt compromised data on its hard drives:

"if You are Responsible in MUNI-RAILWAY ! All Your Computer’s/Server's in MUNI-RAILWAY Domain Encrypted By AES 2048Bit! We have 2000 Decryption Key ! Send 100BTC to My Bitcoin Wallet , then We Send you Decryption key For Your All Server's HDD!! We Only Accept Bitcoin , it’s So easy! you can use Brokers to exchange your money to BTC ASAP it's Fast way!"

The SF MTA's backups don't appear to have been impacted, so it should be able to save at least some data (depending on how old they are). But local San Francisco news outlets say that SF MTA employees aren't sure they'll be getting paid this week, and the agency stands to lose around $559,000 per day for as long as it's forced to suspend charging fares. All told it's just another reminder that we have a lot of work to do securing necessary and highly vulnerable domestic infrastructure before we get too busy internationally expanding the cyber.

Filed Under: encryption, malware, ransomware, san francisco, sf muni
Companies: sfmta

Hospitals Now Seeing 20 Ransomware Attacks Per Day On IT Infrastructure

from the delayed-lobotomy dept

We've talked a lot about how while the lack of security in Internet of Things devices was kind of funny at first, it quickly became less funny as the dramatic scope of the problem began to reveal itself. Whether it's cars being taken over from an IP address up to ten miles away, to the rise in massive new DDoS attacks fueled by your not-so-smart home appliances, folks like security expert Bruce Schneier have made it abundantly clear the check is coming due.

That's particularly true in the healthcare field, where hackable pacemakers and ransomware-infected hospital equipment is becoming the norm. In fact, hospitals in England recently had to cancel hundreds of surgeries in order to "isolate and destroy" a virus that was running amok across the hospital's IT systems:

"We have taken the decision, following expert advice, to shut down the majority of our systems so we can isolate and destroy it," the NHS wrote on its website. "All planned operations, outpatient appointments and diagnostic procedures have been canceled for Wednesday, Nov. 2 with a small number of exceptions."

In the kind of transparency that often is the hallmark of these kinds of attacks, the hospital in question (the National Health Service's Northern Lincolnshire and Goole Foundation Trust in the UK) couldn't be bothered to explain the precise nature of the attack. But security expert Brian Krebs notes it's likely part of the growing trend of ransomware attacks on hospitals that cripple administrative and surgical systems until the hospital is willing to pay a bitcoin ransom:

"Earlier this year, experts began noticing that cybercriminals were using ransomware to target hospitals — organizations that are heavily reliant on instant access to patient records. In March 2016, Henderson, Ky.-based Methodist Hospital shut down its computer systems after an infection from the Locky strain of ransomware. Just weeks before that attack, a California hospital that was similarly besieged with ransomware paid a $17,000 ransom to get its files back.

According to a recent report by Intel Security, the healthcare sector is experiencing over 20 data loss incidents per day related to ransomware attacks. The company said it identified almost $100,000 in payments from hospital ransomware victims to specific bitcoin accounts so far in 2016.

Twenty data loss incidents...per day, many of which aren't disclosed and have an exponential impact on human lives and privacy. Ultimately, as other researchers have noted, it's inevitable that as not-particularly-smart devices gain market share around the world, we'll begin to see more and more attacks on vital infrastructure. Another reason why before we get busy offensively waging the cyber, we need to make damn sure existing infrastructure is protected.

Filed Under: attacks, cybersecurity, hospitals, iot, ransomware

Your 'Smart' Thermostat Is Now Vulnerable To Ransomware

from the the-Jetsons-this-ain't dept

We've noted time and time again how the much ballyhooed "internet of things" is a privacy and security dumpster fire, and the check is about to come due. Countless companies and "IoT" evangelists jumped head first into the profit party, few bothering to cast even a worried look over at the reality that basic security and privacy standards hadn't come along for the ride. The result has been an endless parade of not-so-smart devices and appliances that are busy either leaking your personal details or potentially putting your life at risk.

Of course, the Internet of Things hype machine began with smart thermostats and the sexy, Apple-esque advertising of Nest. The fun and games didn't last however, especially after several botched firmware updates resulted in people being unable to heat or cool their homes (relatively essential for a thermostat).Not quite the future that was advertised. And things are about to get notably more interesting with the news that hackers have figured out a way to load smart thermostats with ransomware. Security researchers Andrew Tierney and Ken Munro demonstrated their thermostat ransomware proof-of-concept at the hacking conference Def Con on Saturday, using the opportunity to highlight how many of these devices aren't transparent and fail utterly at giving users any real control of what's happening on their home network:

"We don’t have any control over our devices, and don’t really know what they’re doing and how they’re doing it,” Tierney told Motherboard. “And if they start doing something you don’t understand, you don’t really have a way of dealing with it."

And again, as we've seen with everything from smart refrigerators to Wi-Fi embedded tea kettles, companies get so excited about the IoT marketing and revenue possibilities, they fail to embed even basic security in supposedly intelligent devices:

"The thermostat in question has a large LCD display, runs the operating system Linux, and has an SD card that allows users to load custom settings or wallpapers. The researchers found that the thermostat didn’t really check what kind of files it was running and executing. In theory, this would allow a malicious hacker to hide malware into an application or what looks like a picture and trick users to transfer it on the thermostat, making it run automatically."

So yeah, imagine waking up one morning to this:Yes, this is just one thermostat and a proof-of-concept, but worries about the IoT industry's total failure to include security on "smart" devices should not be confused with scaremongering or hyperbole. As Bruce Schneier recently warned, the IoT explosion has resulted in the introduction of thousands of new attack vectors in homes, businesses and vehicles across the country, with vendors and Luddite consumers often ill-prepared to quickly update these products when vulnerabilities are exposed. If smart technology doesn't get smarter soon, the future of smart technology...is going to be dumb technology.

Filed Under: iot, ransomware, security, smart thermostat, thermostat

House Of Representatives Tech Team Blocks All Google Appspot Apps Because Of A Single Trojan

from the well-that's...-something dept

We started receiving reports of this last week, but I wanted to track down some details. You may have seen a few other reports, noting that the tech team at the House of Representatives recently started blocking YahooMail because of a big phishing attempt targeted at Congress. On April 30th, the House's "Technology Service Desk" sent around an email stating:

In the past 48 hours, the House Information Security Office has seen an increase of attacks on the House Network using third party, web-based mail applications such as YahooMail, Gmail, etc. The attacks are focused on putting “ransomware” on users’ computers. When a user clicks on the link in the attack e-mail, the malware encrypts all files on that computer, including shared files, making them unusable until a “ransom” is paid. The recent attacks have focused on using .js files attached as zip files to e-mail that appear to come from known senders. The primary focus appears to be through YahooMail at this time.

The House Information Security Office is taking a number of steps to address this specific attack. As part of that effort, we will be blocking access to YahooMail on the House Network until further notice. We are making every effort to put other mitigating protections in place so that we can restore full access as soon as possible.

Please do your part to help us address this recent attack and protect the House Network going forward by following proper cyber practices at all times. Phishing e-mails can look very legitimate and appear to come from known senders. Be very careful about clicking on attachments or links in e-mails, particularly when you are using non-House e-mail systems.

Obviously, it's worth being careful and concerned about this kind of thing. Those encrypted ransomware attacks have become quite popular lately, and you can imagine why some would think it would be fun to target Congress specifically. Still, blocking all of YahooMail seems... like overkill? Yes, obviously, warn everyone to be careful, and highlight the details and what to watch out for. Perhaps institute some other kinds of protections. But a blanket ban on YahooMail just seems odd.

But... that's not all. Because a few days after that happened, the same tech staff also started blocking all of appspot.com. That's where a ton of apps actually live for things like Google's App Engine. Once again, this seemed like total overkill, so I reached out to people at the House to find out what was going on, and was given the following statement:

We began blocking appspot.com on May 3 in response to indicators that appspot.com as potentially still hosting a remote access Trojan named BLT that has been there since June 2015.

Now, this is kind of interesting for a variety of reasons. The Trojan.BLT has been "associated with a major APT [Advanced Persistent Threat] campaign." Furthermore, there has been some speculation connecting it to the Office of Personnel Management (OPM) hack that was exposed last year, based on a timely warning from the FBI about "cyber actors" using a series of exploits -- including BLT -- to gain access to personally identifiable information from the government. As the FBI noted:

Trojan.BLT- a RAT that is executed from its export CreateInstance, the mutex HFRM_ is created and a process instance of cmd.exe is launched to execute the command “ipconfig/all” to collect the victim system’s MAC address. Trojan.BLT will test network connectivity by establishing a connection with a legitimate website. This malware is capable of bypassing dyndns categorization by using a proxy through Google AppProxy’s hosted on appspot domains.

Trojan.BLT will validate the connection by checking the HTTP header “Service:IIS”. Trojan.BLT will then conduct further C2 activity.

So, yes, as I was told, Trojan.BLT was first discovered making use of Google's appspot domains last June -- so it's a little unclear why there's suddenly a renewed focus on it, and why it's cause to shut down access to appspot entirely -- especially since it appears that there are tools that can detect this particular trojan.

So, on the one hand, you can understand why the House's IT staff has pulled out the nuclear option in both these cases, first banning YahooMail and then banning access to basically all of Google's hosted 3rd party apps. Ransomware or an OPM-level hack on Congress would be a massive black eye for the House's tech staff. So it must feel a lot safer to just block entirely. Of course, it's also not that likely to be effective. Ted Henderson, the creator of a social network solely for Congressional staffers called Cloakroom, and who first alerted me and many other reporters to this, was pretty clearly frustrated by this move, which obviously cut off the vast majority of his userbase from actually being able to use the app. But, he's already found a workaround (which I know because I once did an AMA on the platform and still receive notifications from the app). All users received a notification on their phones to turn off their WiFi and use their cellular connections if they wished to use Cloakroom while on Capitol Hill.

And, of course, this shows the futility of just blocking all access to an entire ecosystem like Appspot. It's not going to stop people. It's just going to frustrate people and send them looking for other paths to get that info, which may actually be more dangerous. Instead, it seems worth asking why the House IT staff isn't focused on providing better protection against the actual threat, rather than just trying to bury access to massive platforms, just because lurking somewhere on those platforms there may be something harmful.

Remember, too, that the people in the House are the same ones legislating technology issues today, and they're getting a very warped idea of how technology works thanks to the House's tech desk. A small potential problem that could be avoided with some basic precautions? Shut down the whole damn thing. This seems like exactly the wrong lesson that our elected officials and their staffers should be learning right now about technology. Protecting their computers and devices is obviously important, but it seems like the House is resorting to overkill, and hopefully this does not lead out of touch Representatives to assume that similar overkill solutions -- such as entire site blocking -- are sensible for American citizens. The House Of Representatives is blocking all apps using Google%u2019s appspot.com

Filed Under: appspot, congress, cybersecurity, google appengine, house of representatives, ransomware, trojans, yahoomail
Companies: google, yahoo